docker-compose.prod.yml

@@ -92,6 +92,9 @@
 #                         failing, so an empty value is a working configuration.
 #   ANTHROPIC_API_KEY     Optional. Drafts a listing from a submitted photo
 #                         (#223). Unset means submissions still arrive and wait
+#   INTAKE_ACTION_SECRET  Optional. Signs the regenerate and discard links in the
+#                         intake notification email (#224). Absent, the email
+#                         still sends and carries no shortcuts.
 #                         undrafted, which is a working configuration for the
 #                         same reason USPS is. The one credential here that
 #                         spends money per call, and on a path anybody holding
@@ -225,6 +228,12 @@ services:
       # one, and #227 is the submission ceiling that bounds the volume rather
       # than the bill.
       - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}
+
+      # Signs the regenerate and discard links in the intake notification email
+      # (#224). Optional: absent, the notification still sends and links to the
+      # review queue without shortcuts. Rotating it revokes every outstanding
+      # link, which is how a leaked one is dealt with.
+      - INTAKE_ACTION_SECRET=${INTAKE_ACTION_SECRET:-}
     volumes:
       # Production's own uploads directory. QA writes to
       # /volume1/configs/redefined-designs-qa/uploads; sharing this one would

docker-compose.qa.yml

@@ -54,6 +54,10 @@
 #                     credential here that spends money per call, and it is
 #                     reachable by anyone holding an upload link. Leave it unset
 #                     and submissions still arrive, undrafted.
+#   QA_INTAKE_ACTION_SECRET — optional. Signs the regenerate and discard links
+#                     in the notification email (#224). Absent, the email still
+#                     sends and simply carries no shortcuts. Its own value, not
+#                     production's: a link signed with it acts without a login.
 
 services:
   redefined-designs-qa:
@@ -144,6 +148,14 @@ services:
       # consignment to an expired key would be far worse than an item arriving
       # without its description written.
       - ANTHROPIC_API_KEY=${QA_ANTHROPIC_API_KEY}
+
+      # Signs the regenerate and discard links in the intake notification email
+      # (#224). Optional: absent, the notification still sends and simply links
+      # to the review queue without shortcuts. Anyone holding a link can act on
+      # it without signing in, so this must not be shared with production —
+      # rotating it revokes every outstanding link, which is the intended way to
+      # deal with a leak.
+      - INTAKE_ACTION_SECRET=${QA_INTAKE_ACTION_SECRET:-}
     volumes:
       # Separate uploads directory. Sharing production's would let a QA run
       # write into, and a QA teardown delete, real product images.

docs/ops/production-stack-cutover.md

@@ -60,7 +60,7 @@ Everything here is lost when the stack is deleted, and the rollback in step 8 is
 
 **The stack name**, exactly as Portainer shows it. If it is not `redefined-designs`, note that — the new stack must be created with that name, because the stack name becomes the compose project name and reusing QA's would make Compose reconcile the two against each other.
 
-**Every stack environment variable, name and value.** They belong to the stack, and deleting it discards them. This is the step whose omission is felt hardest. The compose file interpolates fourteen names — `DEMO_MODE`, `DB_PASSWORD`, `SMTP_USER`, `SMTP_PASSWORD`, `SMTP_FROM`, `ADMIN_GATE_SECRET`, `PAYPAL_CLIENT_ID`, `PAYPAL_CLIENT_SECRET`, `PAYPAL_WEBHOOK_ID`, `USPS_CLIENT_ID`, `USPS_CLIENT_SECRET`, `UPLOADS_BASE_URL`, `BACKUP_PASSPHRASE` and `ANTHROPIC_API_KEY` — and an unset one substitutes to an empty string rather than failing. None of it is recoverable from anything in this repository. Take everything the stack holds rather than working from this list; it is here to say how much there is, and it is checked against the file rather than from memory.
+**Every stack environment variable, name and value.** They belong to the stack, and deleting it discards them. This is the step whose omission is felt hardest. The compose file interpolates fifteen names — `DEMO_MODE`, `DB_PASSWORD`, `SMTP_USER`, `SMTP_PASSWORD`, `SMTP_FROM`, `ADMIN_GATE_SECRET`, `PAYPAL_CLIENT_ID`, `PAYPAL_CLIENT_SECRET`, `PAYPAL_WEBHOOK_ID`, `USPS_CLIENT_ID`, `USPS_CLIENT_SECRET`, `UPLOADS_BASE_URL`, `BACKUP_PASSPHRASE`, `ANTHROPIC_API_KEY` and `INTAKE_ACTION_SECRET` — and an unset one substitutes to an empty string rather than failing. None of it is recoverable from anything in this repository. Take everything the stack holds rather than working from this list; it is here to say how much there is, and it is checked against the file rather than from memory.
 
 `USPS_CLIENT_ID` and `USPS_CLIENT_SECRET` deserve naming because losing them is the one failure here that is completely silent. Address validation is skipped when they are empty rather than failing, so checkout keeps working and quietly stops validating addresses. Nothing in step 7 catches it, and there is no crash loop to notice.